ekklesiaandClaude Opus 5.5
33bb146349
Signage no longer needs an Ekklesia checkout. A clean clone installs with `pnpm install --frozen-lockfile` and runs lint, typecheck, test, build, and validate by itself, taking Ekklesia's module-development packages from Ekklesia's public registry (ADRs 0053 and 0054). - Dependencies: every `workspace:*` becomes `^0.2.0`. @ekklesia/module-pack is added as a devDependency pinned exactly to 0.2.0, as ADR 0053 requires; it is not invoked yet. No @ekklesia/contracts dependency. drizzle-orm stays a direct dependency, satisfying the adapter's optional peer. - .npmrc points the @ekklesia scope at https://git.riverofglorymn.org/api/packages/River_of_Glory_Church/npm/ with no credential, because reading needs none. - pnpm-workspace.yaml holds this repository's pnpm settings only: - `allowBuilds: esbuild: true`, as the platform's standalone fixture does; - exact-version minimumReleaseAgeExclude entries for the 0.2.0 train, which pnpm 11 otherwise holds back on its release day; - the platform's narrowly scoped override for GHSA-67mh-4wv8-2f99 (esbuild via drizzle-kit), which Signage inherited while it built inside Ekklesia's workspace. - engines.node `>=24.11.0 <25` and packageManager `[email protected].0`, both from Ekklesia 0.2.0. Node 24.18.0 goes in .node-version for CI, as in Ekklesia. - biome.json carries the platform's Biome configuration, which `biome lint` used to pick up from the workspace root, so lint rules are unchanged. - pnpm-lock.yaml is Signage's own: registry tarballs with integrity hashes, and no workspace or file links. - `prepack` runs this package's own build instead of the workspace root's turbo. - `pnpm validate` (scripts/validate-module.mjs) checks the built package and its migrations with the published SDK parsers only: - the manifest, its identity, and its entrypoints; - that the built runtime's id, version, and database ABI match the manifest; - that the built schema metadata is plain, namespaced, and has module-internal foreign keys; - the SDK compatibility range; - that the migration journal and policy agree. Core's own `modules:validate` and `migrations:validate` are not published. What only an Ekklesia installation can check is named in the script. Removed: ci/assemble.sh, ci/platform.env, ci/pnpm-lock.yaml, ci/update-lock.sh. The lint, typecheck, test, and build jobs check out only this repository; build also runs `pnpm validate`. The integration job stays disabled. Its first step is now an explicit placeholder rather than the deleted assembly, and its explanation says it returns when Signage is a canonical linux-x64-glibc Module Package installed into Ekklesia's generic image. No source, behaviour, schema, or version change: Signage stays 0.1.2. Co-Authored-By: Claude Opus 5.5 <[email protected]>
209 lines
8.2 KiB
YAML
209 lines
8.2 KiB
YAML
name: CI
|
|
|
|
# Signage is a standalone repository: every job checks out only this repository, installs it with
|
|
# --frozen-lockfile from its own pnpm-lock.yaml, and takes Ekklesia's module-development packages
|
|
# (@ekklesia/*) from Ekklesia's public package registry (.npmrc; platform ADRs 0053 and 0054). No job
|
|
# clones Ekklesia.
|
|
#
|
|
# The same trust rules as the platform's own CI (docs/development/security.md there):
|
|
# * every action is pinned by a full commit SHA;
|
|
# * every checkout sets `persist-credentials: false`, and nothing in this workflow pushes;
|
|
# * no repository, organization, or instance secret is referenced;
|
|
# * there is no `pull_request_target`;
|
|
# * the self-hosted runner executes trusted, reviewed code only.
|
|
#
|
|
# The server is Gitea 1.27, which honours `concurrency` cancellation; `permissions` and
|
|
# `timeout-minutes` are declared so the workflow is correct wherever they are enforced.
|
|
|
|
on:
|
|
pull_request:
|
|
push:
|
|
branches:
|
|
- main
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: ci-${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
lint:
|
|
name: lint
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
steps:
|
|
- name: Check out repository
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
# Nothing here pushes, so the job token is never needed after checkout and must not be left
|
|
# in .git/config for a later step to read.
|
|
persist-credentials: false
|
|
|
|
- name: Set up Node.js at the repository's version
|
|
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
|
with:
|
|
node-version-file: .node-version
|
|
|
|
# pnpm at exactly the `packageManager` version, and @ekklesia/* from the public registry named in
|
|
# .npmrc: no token, and no Ekklesia checkout.
|
|
- name: Install (frozen lockfile)
|
|
run: |
|
|
corepack enable
|
|
corepack install
|
|
pnpm install --frozen-lockfile
|
|
|
|
- name: Lint
|
|
run: pnpm lint
|
|
|
|
- name: Check that CI cleans up every stack it starts
|
|
run: bash ci/check-cleanup.sh
|
|
|
|
typecheck:
|
|
name: typecheck
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
steps:
|
|
- name: Check out repository
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
# Nothing here pushes, so the job token is never needed after checkout and must not be left
|
|
# in .git/config for a later step to read.
|
|
persist-credentials: false
|
|
|
|
- name: Set up Node.js at the repository's version
|
|
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
|
with:
|
|
node-version-file: .node-version
|
|
|
|
# pnpm at exactly the `packageManager` version, and @ekklesia/* from the public registry named in
|
|
# .npmrc: no token, and no Ekklesia checkout.
|
|
- name: Install (frozen lockfile)
|
|
run: |
|
|
corepack enable
|
|
corepack install
|
|
pnpm install --frozen-lockfile
|
|
|
|
- name: Typecheck the server, browser, and browser-test projects
|
|
run: pnpm typecheck
|
|
|
|
test:
|
|
name: test
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
steps:
|
|
- name: Check out repository
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
# Nothing here pushes, so the job token is never needed after checkout and must not be left
|
|
# in .git/config for a later step to read.
|
|
persist-credentials: false
|
|
|
|
- name: Set up Node.js at the repository's version
|
|
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
|
with:
|
|
node-version-file: .node-version
|
|
|
|
# pnpm at exactly the `packageManager` version, and @ekklesia/* from the public registry named in
|
|
# .npmrc: no token, and no Ekklesia checkout.
|
|
- name: Install (frozen lockfile)
|
|
run: |
|
|
corepack enable
|
|
corepack install
|
|
pnpm install --frozen-lockfile
|
|
|
|
- name: Unit, browser, and display contract tests
|
|
run: pnpm test
|
|
|
|
build:
|
|
name: build
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
steps:
|
|
- name: Check out repository
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
# Nothing here pushes, so the job token is never needed after checkout and must not be left
|
|
# in .git/config for a later step to read.
|
|
persist-credentials: false
|
|
|
|
- name: Set up Node.js at the repository's version
|
|
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
|
with:
|
|
node-version-file: .node-version
|
|
|
|
# pnpm at exactly the `packageManager` version, and @ekklesia/* from the public registry named in
|
|
# .npmrc: no token, and no Ekklesia checkout.
|
|
- name: Install (frozen lockfile)
|
|
run: |
|
|
corepack enable
|
|
corepack install
|
|
pnpm install --frozen-lockfile
|
|
|
|
- name: Build the server and both browser artifacts
|
|
run: pnpm build
|
|
|
|
# The built package and its migrations, read the way the platform reads them, with only the
|
|
# published SDK parsers (scripts/validate-module.mjs says what only Ekklesia itself can check).
|
|
- name: Validate the built module and its migrations
|
|
run: pnpm validate
|
|
|
|
# Signage inside Ekklesia, end to end, in a real browser: the platform's own Dockerfile builds the
|
|
# deployment image with Signage in it, and the platform's split-topology deployment smoke runs
|
|
# against it, pairing a kiosk display and running the scenarios in ci/display-scenarios. A
|
|
# disposable database and object store with generated secrets; nothing is pushed or logged in to.
|
|
#
|
|
# DISABLED. From Ekklesia 0.2.0 on, the platform's image is the one generic image (platform ADR
|
|
# 0048): deploy/Dockerfile keeps `modules/` out of its build context and refuses one that has it,
|
|
# and the deployment smoke installs modules only as canonical Module Packages (ADR 0049). Signage is
|
|
# not one yet: its static sharp dependency needs the native linux-x64-glibc package flow. Run as it
|
|
# was, this job would build an image without Signage and drive the module template's display
|
|
# instead, so it is switched off rather than left reporting on something else.
|
|
#
|
|
# It returns when Signage is built as a canonical linux-x64-glibc Module Package and installed into
|
|
# Ekklesia's generic image; that change removes `if: false` and rewrites these steps. They still
|
|
# expect the platform tree ci/assemble.sh used to build at build/workspace, and that assembly is
|
|
# gone now that Signage builds on its own. The platform's deployment smoke and stack sweep will
|
|
# still come from Ekklesia, at the release Signage targets, because they are the platform's to run.
|
|
integration:
|
|
name: integration
|
|
if: false
|
|
needs:
|
|
- test
|
|
- build
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
env:
|
|
DOCKER_BUILDKIT: "1"
|
|
# Names this job's stacks, so its final step removes exactly these (the platform's
|
|
# scripts/lib/ci-project.sh).
|
|
EKKLESIA_CI_JOB_KEY: signage-integration
|
|
steps:
|
|
- name: Check out repository
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Fetch Ekklesia's deployment smoke and build Signage's Module Package
|
|
run: |
|
|
echo "integration: rewritten when Signage is a canonical linux-x64-glibc Module Package." >&2
|
|
exit 1
|
|
|
|
# A job the runner killed (cancelled, or past the runner's own time limit) never ran its
|
|
# cleanup. Anything a CI job left on this shared daemon more than three hours ago goes first.
|
|
- name: Sweep stale CI stacks from the runner
|
|
run: bash build/workspace/scripts/ci-sweep.sh --stale
|
|
|
|
- name: Build the image and run the display scenarios
|
|
run: bash ci/integration.sh
|
|
|
|
# Whatever happened above, this job's own stacks do not outlive it. If the first step failed,
|
|
# nothing was started.
|
|
- name: Remove this job's CI stacks
|
|
if: always()
|
|
run: |
|
|
if [ -f build/workspace/scripts/ci-sweep.sh ]; then
|
|
bash build/workspace/scripts/ci-sweep.sh --job
|
|
fi
|